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Command and Control: Kunsan 

In the fall of 1959 I moved to Camp Smith, CINCPAC 
headquarters in Hawaii [as part of the Office of Naval Research 
(ONR) Study Group on CINCPAC (Commander in Chief Pacific) Command 
and Control of Nuclear Weapons] . I didn't agree to stay for the 
whole year since my wife wasn't willing to accompany me. But I did 
go for several months at first, then went back repeatedly during 
1960 to help the group in later states of their report. 

The basic problem we were to look at was how to assure 
reliably that an "execute" message ordering the implementation of 
nuclear war plans would get out to the various forces in the 
Pacific, if a decision were ever made to use nuclear weapons. But 
there were many related questions. 

Another problem that I was interested in was reducing the 
possibility of unauthorized action: how to assure that no 
subordinate would be able to launch the forces under his command in 
the absence of an authorization from his superiors or from the 
President. 

A third problem was how to assure the survival of authority at 
various levels of command so that the whole command structure 
couldn't be put out of action by a coordinated surprise nuclear 
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attack. 

[Describe linkages between these problems.] 

Eventually, in examining these problems, I was in almost every 
command poast and in particular every underground command post in 
the Pacific and the US. For survivability, the locations of most 
of these were supposed to be secret, but since hundreds of people 
worked at these places, that was not an easy secret to keep from 
local residents. For example, the US command post in Japan was in 
what had formerly been, as many Japanese knew, the underground 
Japanese Imperial Command Post, in the outskirts of a suburb of 
Tokyo. 

In Hawaii a major command post was located underground in what 
had originally been an ammunition storage depot, built under a 
pineapple field in Hawaii during the Second World War. Its secret 
location wasn't shown on any of the local maps. The first time I 
drove out through the pineapple fields to visit it, I had 
directions that located it near a particular crossroads. I got 
lost, and stopped at a small grocery store by the road to ask 
directions to the crossroads. 

The woman behind the counter said, "Oh, you mean the 
underground?” She proceeded to give me precise directions not only 
to the crossing but to the entrance to the secret facility. 
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Apparently lots of visitors needed help on their first try. 

Other aspects to their survivability were equally problematic. 
Their main advantage was that they were underground and heavily 
reinforced with concrete. But the older ones had been designed to 
survive an attack by conventional, high explosive bombs, not 
nuclear weapons and especially, not high-yield thermonuclear 
weapons (H-bombs). So very little attention had been, in 
particular, to blast doors, as of the start of the '60's. 

Even if a structure underground or inside a mountain had 
enough rock and concrete shielding it to survive an explosion 
directly above it, the blast from a nuclear explosion, whether 
above it or anywhere in the vicinity, would be so great and so 
pervasive that it would blow through any ordinary security door and 
kill everyone inside. The same was true for every aperture letting 
in ventilation or letting out communications via cables and 
antennas. They had all to be equally secure against blast 
pressure, along with the doors, or the whole facility was worthless 
in terms of survival. 

This was not an easy problem to solve, but it wasn't the only 
one. Even if the people inside should survive, assuring that they 
could communicate outside after a nuclear attack was difficult. 
For example, an explosion could destroy the operation of all the 
radio transmitters inside, even if the human operators survived, 
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just by shaking up all the electronic equipment, apart from more 
esoteric and intractable electronic and magnetic effects on their 
functioning. 

Most of the members of our study group were communications 
specialists looking at problems like these. They were responding to 
the real interest of CINCPAC and his staff in establishing the 
study, how to assure that they could carry out their mission of 
exploding nuclear weapons over Russian and Chinese targets when 
appropriate. But in their extreme preoccupation with this problem, 
these staffs tended very sharply to deemphasize certain others, 
such as the problem that attracted my own attention, assuring that 
these weapons not explode when not appropriate. 

A little more than lip service was paid to dealing with the 
latter issue, but not enough to give any real assurance. The 
priorities, in terms of attention and of preventive action, were 
very, very strongly skewed in the other direction. 

This was especially true because the military operators were 
aware that there was a very high likelihood, much greater than 
presidents and other civilians were likely to realize, that both 
command authority and communications would be disrupted in a 
nuclear attack. 


On the one hand you had a legal and policy framework that 
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presumed that only the president could decide on and order the 
irrevocable launching of nuclear weapons. That was what the public 
was told and wanted to believe, and probably most presidents 
believed it when they came into office and for some indefinite 
period after that. After all, that was a transcendent decision, 
and the president (not, by law, the vice president) was the only 
elected political leader in the military chain of command. 

At the same time most military officers up and down the chain 
of command were aware that the president himself could easily be 
killed by a bomb on Washington. It wouldn't even have to be a 
nuclear bomb, just a terrorist blast. For that matter, even a 
gunshot, inside or outside the Washington area depending on where 
the president was, could deprive the chain of its Commander in 
Chief until civilian succession could be established, as we saw in 
1963 and 1981. But even a small nuclear weapon in Washington could 
take out nearly all the civilian successors simultaneously, along 
with the military high command. And a handful of other weapons, a 
tiny fraction of what would be launched in a major attack, could 
destroy command posts and communications centers outside 
Washington. 


These officers lived with what was for them a nightmare: that 
in the event of actual enemy attack there was no high likelihood 
that a retaliatory "execute” command authorized at high levels 
would ever be sent or would reach the actual operating levels of 
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the nuclear delivery forces. 

As a result there was great resistance on their part to the 
very notion of procedures or devices that would make it physically 
impossible for those at lower levels to take nuclear actions on 
their own in the event of an actual war. 1 Such procedures or 
systems could lead to the paralysis of our nuclear retaliatory 
capabilities, their inability to carry out what these officers saw 
as their most important, virtually sacred mission on which the 
physical survival of the nation depended, precisely at the moment 
when it was most needed. The very possibility of this, understood 
by the enemy, jeopardized deterrence and made this nightmare more 
likely. 


At the same time, these officers had always to give lip 
service to the assumption that only the President could "release 
those weapons." The net effect of these pressures was that they 
chose not to look closely at the system that really resulted from 
their choices. That system, I discovered when I did look closely 
at it, left enormous leeway, in fact almost untrammeled 
opportunity, for individuals to carry out unauthorized action. 


Between 1958 and 1961 I had become as knowledgeable as anyone 
in the country on the details and possible defects of this control 
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system. In fact, in the spring of 1961 I once received a phone 
call from the Pentagon from Adam Yarmolinsky, who identified 
himself as the Assistant to the Secretary of Defense. It was my 
first exchange with Yarmolinsky, who two years later offered me a 
job as his deputy. He started by saying he had been told that I 
was the most knowledgeable civilian expert on command and control. 
I said that could be true. He said that Stanley Kubrick, who was 
just starting work on Dr. Stranaelove . hadn't yet decided whether 
he would allow the Department of Defense to view his rushes, or a 
rough cut of the movie. If he did, was I willing to be their 
representative in reviewing it? I said I would be happy to do it. 
But Kubrick decided against it. 

The movie didn't come out till 1964. Harry Rowen and I took 
an afternoon off from the Pentagon to go see it in Washington. 
When we came out into the sunlight, we looked at each other and 
agreed that it was no fiction, it could as well have been presented 
as a documentary. Harry had heard my stories. There was nothing 
in it that couldn't have happened the way Kubrick showed it, 
including the personal interactions. We had a feeling we had met 
prototypes for the military officers and civilian analysts on the 
screen. 

At that time I thought that the problem presented in William 
Burdick's book Fail-Safe and the movie based on it, a mechanical or 
electronic failure by a computer that transmitted an improper 
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direction, was not very likely to lead to an unauthorized launch, 
since there were many levels of human intervention at various 
points. Actually, three major false alarms occurred in 1976 [check 
date] along these lines, two of them from failure of a minor 
transistor and one from the transmission (by human error) of a test 
tape of a simulated attack. 

But by the late '50's I had already read the book on which 
Stranaelove was based, Red Alert by Peter Bryant, as had many 
people at RAND. The name Bryant was apparently a pseudonym for 
someone who seemed strikingly familiar with actual operational 
procedures. (I heard later that the real author was a former 
officer in the strategic bombing command of the RAF). 


The more I learned, the more I became aware of the possibility 
that an honest misunderstanding of a situation by a lower commander 
might lead him to believe that it was his duty to carry out such an 
attack. (This possibility was alongside that imagined by Terry 
Southern in the screenplay of Dr. Stranaelove . where a base 
commander acts on sincere but more delusional concerns about 
protecting vital fluids from Communist menace). If so, I found, he 
had the physical and operational capability to do it. 

From the beginning of my work at RAND in the summer of 1958, I 
had been concerned with the "false alarm" problem. My focus on 
this reflected the immediate match between my work at Harvard on 
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ambiguity and decision-making under uncertainty and the earliest 
RAND analyses I was reading by Albert Wohlstetter and others on the 
likelihood that the warning of attack that would reach the 
president would be highly ambiguous, and how this might affect his 
decisions. 

That likelihood was the central premise of their analyses and 
their recommendations. What should the president do, and prior to 
that what options should prepared for him to choose among, in the 
face of conflicting and uncertain warnings of enemy attack? How 
should the president and the system as a whole prepare for the 
possibility and respond to the fact that evidence and even firm 
predictions of enemy attack may occur which may be misleading, 
false, in that no attack is actually underway? And how is the 
present system likely to respond? 2 

Wohlstetter took credit for originating the "positive 
control" process, as a partial answer to this problem. 3 This 
created a "launch on warning" option with respect to bombers that 
was separable from the decision to execute the war plans, i.e., to 
send the bombers to target. 4 This made it appear safe enough to 
launch planes, in order to protect them from being destroyed on the 
ground by enemy attack, to delegate authority to do this to base 
commanders or higher military authorities below the level of the 
president. 
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The system I was introduced to looked like this. [What 
follows is a rough, a long, first draft. It will be edited and 
condensed.] 

According to the Top Secret war plans, any order to "Execute" 
a nuclear war plan had to be based on an immediate, explicit order 
from higher authority, ultimately from the President himself. 

But there were provisions in the plans for taking various 
preparatory actions on local authority, and even for launching 
planes on warning of imminent enemy attack, to protect them from 
destruction. Such a launch was not supposed to be tantamount to a 
decision to "Execute," i.e., to proceed to targets. 

It would be under "positive control," which meant that the 
planes were to proceed to a predesignated rendezvous area, where 
they would circle till they got an explicit, "positive" order 
either to "Execute," i.e., to proceed to targets, or to return to 
the base. If they got no order at all, they were to return to 
their base, at the point when they had just enough fuel to do that 
safely. 

This procedure was also known as "fail-safe." Thus if there 
were a failure in transmission from the base, a failure to transmit 
an intended signal either to go ahead or to return, the planes were 
to act as if they had gotten a message to return. This response 
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might be an error if there was actually a war on, but a "safer" 
error than the mistake of going to target when there was no war on. 

The purpose of the positive control procedure was to give 
force commanders the delegated authority to get their planes into 
the air so they wouldn't be destroyed on the ground, without giving 
them authority to initiate a nuclear attack. It separated, both 
formally and practically, the order to launch from an order to 
attack. 

The term "positive control" or its synonym, "fail-safe 
procedure," meant that the pilots were to be trained and drilled 
to understand that they were never to go to target under any 
circumstances without a positive and authenticated order, explicit 
and immediate, from higher authority to do so. 

They were not to assume that that was desired or appropriate 
under any circumstances if they had not been told specifically at 
the time to do it. And that order had to be "authenticated" as 
coming from the highest authorities, i.e., it had to be accompanied 
by coded evidence and to come in a manner that made its origins at 
highest levels unmistakably clear. 

The were not to assume that a launch order amounted to an 
execute order, or that it would certainly be followed by an execute 
order, even if it came under circumstances when an enemy attack was 
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expected. 

The question I chose to address was, how reliably would their 
behavior conform to these instructions? I knew from my own 
experience in a highly disciplined organization, the Marine Corps, 
and from my reading of military history, that their actual beliefs 
would not depend only on what they had been told to assume or not 
to assume but on their actual experience. And their behavior would 
reflect to some extent their actual beliefs, not just what they had 
been told to do under prescribed assumptions. 


Discipline, even, perhaps especially, in an elite outfit, 
didn't guarantee robotic, rote-like performance. Contrary to 
popular belief, it wasn't meant to. At least, that was what I had 
learned in the Marines, not only from my own gut experience but 
from those officers and men I had met or read about that I most 
respected. 

Thus, to take a naval example, a helmsman or officer of the 
deck on the bridge of a ship, whose captain is asleep in his bunk, 
may suddenly perceive that the ship is about to run aground or to 
hit another ship if he continues to carry out his standing orders 
or the last instructions he received. 


He can continue to carry out those orders, or he can try to 
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wake the captain or to get a decision from some intermediate 
authority, or he can take an initiative to avert the collision that 
violates his current orders. If he takes the initiative, he will 
probably be investigated for insubordination and he might be 
punished, even if he does save the ship. But he might feel that 
that was the right thing to do even if he were punished for it. 5 

Some of them, including some of the most loyal, dedicated, 
obedient among them, will do not what the letter of their orders 
demand but what they believe their leaders would want them to do if 
they shared their subordinates' knowledge about the actual local 
circumstances and if they could reach a decision and communicate it 
to the subordinates in time to take appropriate action. 

Such "ifs" reflect an understanding of operational realities 
that some without experience inside large and farflung 
bureaucracies may not appreciate. Messages take time to travel, 
often an unpredictably long time even when they are assigned the 
highest priority and individual parts of the journey are at the 
speed of light. In large organizations they go through several 
stages before they reach their intended audience; each of these 
stages occupies time and introduces a chance of error in 
transmission and a chance that the messsage will be totally 
misrouted or aborted so that it never gets through. 

If and when a query or warning from a subordinate does get 
through, it competes with many other messsages from others for the 
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superior's attention. If it does get some attention, its import 
and urgency may or may not be comprehended. Time is needed for a 
decision; and the decision, communicated back to the subordinate, 
goes through similar delays and possible errors. And atmospheric 
conditions or enemy action might block transmission altogether. 

When we see the light of a distant star, we know (at least, an 
astronomer does) that the star itself may have ceased to exist 
years ago, while its light was travelling to us. And when the 
order of a distant commander arrives in the field, an experienced 
field officer knows that it reflects the understanding of the 
higher commander and his staff of the local situation as it was 
some time ago, or as it was then expected to be at the moment the 
order is received. 

The actual situation at this moment may be entirely different 
from what it was or was expected to be. Of course, the order will 
also reflect information available to the higher commander and 
various considerations that the subordinate doesn't share. Knowing 
this, the conscientious field officer in a situation where the 
order looks highly inappropriate for reasons that the high command 
probably doesn't yet know must at least ask himself, "What would my 
commander want me to do if he was here at this moment?" 

If there seems to be time and capability, the field officer 
may send back a query, a warning, an updating on local conditions, 
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up through channels to his superior, even if he knows that this 
questioning of his orders is likely to be perceived negatively, as 
troublesome or insubordinate or incompetent. It might even be 
against a standing rule. (A nuclear "Execute" order was supposed 
to be obeyed instantly without eliciting queries that might clog 
communications channels. In practice, the first "Execute" order 
since Nagasaki, 1945, was likely to evoke a back-tide of requests 
for corroboration.) That is one of his real options. But there 
might not seem time for it, given local conditions and given the 
sense of urgency conveyed by the order itself to do something 
appropriate. 

Likewise, the lack of a positive order to execute, following 
an order to launch that was accompanied or followed by strong signs 
of an enemy attack, will be ambiguous . It may mean that a return 
to base is desired. It is certainly supposed, according to the 
written rules, to be responded to eventually as if it surely meant 
that. 


Nevertheless, it may mean that an order to execute has been 
sent but has not arrived yet, and may not arrive in time for it to 
be carried out with remaining fuel. Or that it would have been sent 
and received had not enemy nuclear attacks wiped out the commander 
or the transmitter or interfered with the transmission. 


It could, in other words, be a very ominous indication, 
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depending on what other evidence is available. For example, how 
often had they had the experience of getting to this point, of 
circling in a rendezvous area, without getting a message to return 
and without, as it turned out, their base having been under attack? 

If the whole procedure were practiced often enough up to this 
point, the pilots would come to expect on any given occasion, in 
the absence of any other evidence, that they were taking part in a 
drill. And they would have acguired a habit of returning. They 
wouldn't feel any pressure to break that habit, to disobey their 
standing orders and to take off for their targets, even if they got 
no further orders. They would return to their base routinely. 

But our CINCPAC study group found on our field investigations 
that it was not at all clear that most pilots in the Pacific got a 
chance to acquire such a habit. The first part of the procedure'was 
practiced very frequently, in fact daily, at random times, up to 
the point where planes were ready to taxi for takeoff. We actually 
witnessed this on our visit to Kadena Airfield on Okinawa. [At some 
point this story is to be told] . That was to assure that the planes 
would be ready to take off in time when ordered. At that, practice 
had made them perfect. 

But the later part of the procedure, to assure that they would 
come back from their rendezvous area unless they were ordered to 
proceed, was much more time-consuming and expensive in fuel and 
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maintenance, and it was clearly practiced much less often. We 
asked, was it ever rehearsed at all? Answers on that were vague 
and conflicting. It was understood that SAC, which had invented 
this procedure, did do full-scale rehearsals of it frequently, but 
it was not clear that theater forces ever did. 

In fact, we learned at Kadena that the tactical alert planes 
there never actually left the ground in their daily drills, and 
that wasn't just for reasons of expense. They were barred even from 
taxiing from their alert pads to the point of takeoff. The reason, 
we were told, was the danger of accident, possibly a nuclear 
accident. 

Each of the alert planes, single-person F-100's, was carrying 
an underslung nuclear weapon outside the plane, beneath the 
undercarriage. Many of these weapons, we were told, were of a type 
that were shortly to become obsolete. They were not "sealed pit." 
They were designed to carried inside a plane, for greater safety; 
but there was no room for that in these tactical fighter-bombers. 

Moreover, they were not "three-point safe." These H-bombs, 
thermonuclear fusion weapons, were triggered by a plutonium bomb of 
the type that destroyed Nagasaki. The plutonium core was 
surrounded by a spherical web of shaped-charges of high explosive. 
When these all detonated simultaneously, they "imploded" the 
plutonium core inside, squeezing it to a density that gave it 
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greater than critical mass, leading to a nuclear fission explosion 
that in turn triggered the thermonuclear fuel. 

"Three-point safe" meant that the design ensured that if one, 
two or as many as three of the high-explosive shaped-charge 
sections exploded accidentally, no significant nuclear yield would 
result. Only if more than three went off—from being dropped, 
burned, fired into, or from an electrical malfunction—might there 
be a partial nuclear explosion or a possible full yield. 6 

Since these weapons were not three-point safe—they may not 
have been one-point safe—there was a danger that if they were 
dropped, or involved in a crash or fire or explosion, one or two 
sections of the high explosive might go off and that might be 
enough to cause a partical or total nuclear explosion. While the 
probability of this was small, the risk was worth taking in a 
practice drill, which after all happened once a day. 

Therefore, in these practice alerts, the pilots would jump 
into their planes and gun up the engines. But they didn't go to 
the point of racing down the runway, or even taxiing over to the 
runway from their pads, let alone take off. They didn't do this 
precisely because of the risk of an accident in which there would 
be at least a high explosive yield and possibly a partial nuclear 
explosion. This might happen if a plane heeled over and crashed, 
or two planes crashed into each other, while taxiing or 
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accelerating. 

The pilots, of course, often flew their planes without 
weapons, when they were not on alert. And apparently they also did 
training missions with actual weapons. But we found it very hard 
to get a clear answer whether pilots on actual standby alert ever 
took off, in a practice drill, from their alert pads with weapons 
aboard. Certainly not very often, if ever. Probably never. 

That said to me that if they ever were ordered to take off 
from those pads, it would be an extraodinary, perhaps 
unprecedented, experience for the alert pilots. Even if it was in 
fact, unknown to them, only a drill, the first time (or two) that 
it happened would almost lead them to infer that "this was it,” an 
enemy attack was underway or else they were leading a preemptive 
strike. At the very least, they would have to infer that the 
indications of enemy were more serious than they ever had been 
before. It would be in that state of mind that they would head for 
their rendezvous areas, even if received no "Execute” order to 
follow their "Launch" order. 

This particular consequence of the lack of regular rehearsal 
of take-off under fully realistic simulated alert conditions didn't 
seem familiar to any of the nuclear control officers or pilots that 
I questioned. They all seemed to hear my reasoning as new, 
interesting and plausible. That was worrisome. They agreed: the 









20 


first time, even the first few times, that alert pilots found 
themselves circling in a rendezvous area with bombs aboard waiting 
for an "Execute" or a "Return" message, they would be strongly 
inclined to expect the first, simply because it was the first time 
they had ever gotten that far. 

They would believe the war was on, or was imminent, because 
the commanders who had launched them unprecedently would appear to 
have thought so. 

What if they had other reason to think that, as well? Suppose 
this launch came in a time of international crisis, either in the 
region or elsewhere in the world. Suppose there had been earlier 
"strategic warning" of heightened danger of war, or of attack. What 
if there were an actual war going on in the area, between China and 
Taiwan, or in Korea, or Indochina. (The second Taiwan Straits 
crisis had lasted for months just the previous year, 1958. I 
didn't know it at the time, but it had been, in fact, an intense 
nuclear crisis. That's another story, to be told elsewhere in this 
memoir.) 

What if there were, in the course of the launch or soon after 
it, a nuclear explosion on an American airbase in the region, 
perhaps on this very base? On first thought, that might seem 
improbably coincidental, stretching too far for a "worst case." On 
second thought, not at all. (As far as I could tell from 


many 
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conversations, no one else in the area had had the first thought, 
let alone the second. No one found it implausible after a brief 
discussion). 

It was only necessary to recall why the alert F-lOOs, despite 
a command obsession with realistic drills and with meeting 
standards, rarely if ever rehearsed to the point of take-off. It 
was precisely because of the serious danger of a crash and its 
possible nuclear consequences, with these particular bombloads. 
The other side of that reluctance, the very basis for it, was an 
estimate by commanders that that if a number of these planes 
actually taxied to the runway and took off in a great rush, one or 
more of them might bump into another or otherwise turn over, burn 
and explode, and produce a nuclear fireball. 

That possibility itself wasn't remote from people's thoughts. 
It was why they didn't taxi. What they hadn't thought about was 
the next question. What would the effect of that event be on the 
minds of the alert pilots who had already taken off, either from 
that base, or from another one nearby, or even from a distant base 
in the same region? 

They might, of course, guess at the true reason, that an 
unprecedented accident had occurred. But even if that occurred to 
them at all, it would be competing with another explanation, which 
might seem much more likely under the circumstances. After all, 
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why were they in the air at all, with their bombs aboard? A 
realistic, no-warning drill, for the first time, despite the risks? 
Or because higher authority had perceived evidence of an imminent 
enemy attack, stronger than ever before , perhaps certain? And now 
this explosion! The attack would appear to be taking place. 

At this point a lot of communications would be taking place 
among the airborne planes and they would be attempting to 
communicate back to their base. But if there had been a partial 
nuclear explosion at that base, that would be impossible. The 
blast itself would probably have destroyed all transmitting points 
at the base, but beyond that the electronic effects of the 
explosion would disrupt all high frequency communications in a 
considerable area. 

That would mean that the last signal that these planes would 
receive from their base, and perhaps, for quite a while, from any 
other bases in their vicinity, would be the sight of a mushroom 
cloud rising over the runway they had just left. They would then 
be out of communications locally. The later lack of an "Execute" 
or "Return" order, or any other, would have an easy explanation, 
and it wouldn't be routine. All this in the context of the fact 
that they had just received a "Launch" order that was 
unprecedented, or nearly so, a circumstance that in itself would 
make some or all of them nearly certain that an attack was 
imminent. 
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What this meant to me was that a false alarm so serious as to 
cause a "Launch" command to alert tactical forces in the Pacific 
(and probably anywhere in the world, at least where the weapons 
carried were such as to preclude frequent rehearsals of launch) was 
likely to generate the belief in the minds of some airborne pilots 
armed with megaton weapons that, although they had not received an 
execute order, general nuclear war was underway, and that they had 
no ability to receive an execute order because communications had 
been disrupted by the war. 

Moreover, a "Launch" order could be followed closely by a 
nuclear explosion on a US base, precisely because it would lead to 
the actual launching of numbers of planes with nuclear weapons that 
were known to be less than maximally safe. In fact, these 
probabilities, individually low but not independent, could cascade 
even further. 

If the false alarm leading to precautionary launch was 
widespread in the theater or even worldwide, the numbers of bases 
and planes involved would greatly increase the chance of an 
accidental explosion somewhere. But even if the initial takeoffs 
were at the initiative of a single base commander, a large 
explosion (even with high explosive alone; the cause and nature 
would be ambiguous for a time) and especially a nuclear explosion 
would lead to many precautionary launches elsewhere, likewise 
increasing the chances of a second explosion. And any of these 
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would lead to many precautionary launches elsewhere, likewise 
increasing the chances of a second explosion. And any of these 
would simultaneously disrupt communications. 

My knowledge of military interpretation of orders and military 
dedication, from my own experience in the Marines and, by now, a 
couple of years talking with high-level staff officers, convinced 
me that in that situation many of them would regard their duty as 
being to carry out their mission, their general war mission, in 
violation of the strict letter of their orders to await a positive 
authorization. The authorization would be unlikely to be 
forthcoming, they would suddenly realize, if an enemy attack had 
intervened soon after their launch orders. 

Thus, without the commander contemplating a precautionary 
launch realizing it, and despite the positive control procedures in 
force, his command to launch might be tantamount to an execute 
order after all. 

When I tried out this line of reasoning to experienced staff 
officers at various command posts and bases in the Pacific, nothing 
I heard back was reassuring. They found it unfamiliar and 
immediately plausible. No one came up with some operational 
characteristic or practice I had left out that lowered the odds of 
the disastrous sequence I was projecting. 7 
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I felt I needed to test out these thoughts at the lowest level 
of command. Looking at a map at headquarters in Japan, I picked 
out a small airbase in Korea, Kunsan, the northernmost base with 
nuclear alert planes in Korea, i.e., in the Pacific. In fact, its 
alert planes with nuclear weapons may have been closer to Communist 
territory than any others in the world. Our group could get rides 
on military planes and we had a kind of "go anywhere, talk to 
anyone, see anything" clearance. On short notice, I decided to 
take a trip to Korea to talk to the officer in charge at Kunsan. 

I landed in Seoul and got myself a ride on a light plane over 
barren, unpopulated hills up to Kunsan. I found myself in 
something like a little town in a frontier western, with a dusty 
airstrip. The officer in charge of the base was an Air Force major. 
He was in command of ten F-lOOs, each with an underslung Mark-28 
thermonuclear weapon with a yield of 1.1 megatons. 

One of those bombs had the explosive equivalent of half the 
tonnage the US dropped in World War II. The major in charge of 
this little collection of Quonset huts and planes in the hills 
controlled six and a half World War II's worth of firepower. 

As at Kadena, they weren't sealed pit weapons, not three-point 
safe. They didn't practice taxiing or taking off in drills with 
weapons aboard. A portion of this squadron was on alert at all 
times, in fact, my memory is that all ten were, which would imply 
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that they had multiple crews, but it might have been just four or 
six. Because of the nature of the weapons and the way they were 
carried, as at Kadena, there would a danger if several of them were 
launched suddenly with weapons in an alert that there would be a 
collision or an accident that could produce a partial or a full 
thermonuclear explosion. That would eliminate all communications 
from that base and in a considerable area around it. The last 
information anyone would get (ever) from Kunsan would not be a 
message but evidence that a thermonuclear explosion had destroyed 
the base. How would other bases respond to that news? 

Well, how would the major at Kunsan respond to news like that? 
Would he launch on planes on alert? If he were to do that on his 
own, I knew from a briefing at Osan, it would be against his 
orders. Because this base was so close to Communist radar, the base 
commander at Kunsan didn't have the normal authority to launch his 
planes at his own initiative, even as a precaution against attack, 
on positive control, because of the danger that either the Koreans 
or Russians would spot them on radar and interpret their 
precautionary launch as an attack. He wasn't to launch them at 
all, under any circumstances, except on direct order from higher 
headquarters via Tokyo, possibly relayed through Osan. I wanted to 
him reiterate that, then go on to test him on some 
hypothetical circumstances. But I had some preliminary questions. 

We were just minutes of flying time away from North Korea, but 
these planes were targeted on northeast Russia, just a few minutes 
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further. I asked the major how long it would be, if they took off 
toward their rendezvous area, before they would be picked up on 
North Korean or Russian radar, and how long before they were out of 
line-of-sight communication with their base. He got edgy, said 
these were very sensitive questions, and refused to answer unless 
he "saw my authorization." 

After he did this a couple of times I got irritated and said, 
"Well, we'll just have to call Japan and let you talk to someone." 
We went into his command hut and he tried to get headquarters in 
Japan by radio. This brought out the interesting fact that he was 
out of communications with Japan, and had been for the last couple 
of hours. He couldn't get through to Japan via the main 
headquarters in Korea at Osan, either. I asked him how often this 
happened and he said that "about once a day" atmospheric troubles 
of different kinds put him out of touch with Japan. 

I didn't think it was worth pursuing our discussion till he'd 
talked to the Operations desk in Japan about my access, so I waited 
for almost an hour, reading magazines in his hut. Osan had an 
a i er t strip too, where .I'd had some discussions before I flew up to 
Kunsan. It occurred to me that if there were a nuclear explosion 
there for the reasons I was exploring, Kunsan could be cut off from 
communications with the rest of the world. 


Finally he got through to Japan and got the word that he could 
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tell me "anything." He asked me to run my questions by him again. 
I did, and he shook his head and said calmly that he didn't know 
the answers. 

It was a funny follow-up to his expressed concern about 
security that had delayed us for the last hour. I asked myself if 
he was kidding me now, but he seemed sincere and I let it pass. 
And from then on he got quite communicative. He hadn't run into any 
researchers before at Kunsan and he seemed to enjoy speculating 
about the issues I was raising. 

I asked if there were any circumstances when he would send his 
planes onto alert in the air. For example, what if he learned 
there had been a nuclear explosion at another base in the region? 
The major said, "Well, you know when I'm supposed to do it, don't 
you?" He seemed to be testing me, what I knew. 

I said, "Yes, only when you get an order from Japan or Osan." 

He said, "That's right. I'm not supposed to let those planes 
take off without a direct order." Without any break he went on to 
say, "But let me tell you, I'm the commander of this base, and 
every commander has an inherent right to protect his forces. 
That's one of the fundamental laws of war. It's the oldest 
principle of war that as a military commander I have the right and 
authority to protect my forces and if I believed that they were in 
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any danger, if I heard there'd been a nuclear explosion in the 
Pacific, I would send them off." 

I couldn't figure why he was telling me this, why he seemed to 
want to put it on the record. We had just established that I was 
there investigating nuclear command and control for the Commander 
in Chief Pacific, Admiral Felt, and he was telling me in the most 
matter of fact way that he felt empowered by fundamental principles 
of war to violate very specific and explicit directives sent down 
by CINCPAC. 

It was hardly a surprise to me that a field commander might 
come to feel like that under some circumstances. That was the 
intuition that had brought me to Korea. But I didn't expect that 
he had already thought it out, or that he would be so ready to tell 
me right out that he didn't feel bound by his orders from the 
headquarters I came from. 

Those orders, after all, weren't just arbitrary. They were 
specific to Kunsan precisely because of the closeness to enemy 
territory and radar. A sudden mass takeoff might be detected and 
interpreted by the Communists as a warning of imminent attack. (In 
fact, in view of what the major was about to tell me next, the 
enemy wouldn't be very foolish to think that). So there was strong 
reason to keep his planes tightly under higher control, whether or 
not the major thought that violated principles of war. 
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I didn't react. I wanted to explore what conditions might lead 
him to launch his planes. I asked him how he would interpret a 
sudden outage of communication that came during an intense crisis. 
He said yes, that might well lead him to get his planes off the 
ground without orders from above. 

Again, that wasn't a surprise in itself, or wouldn't have been 
on some other base, where it didn't imply any violation of their 
directives. This was so even though in that era outage of 
communications from natural disturbances was a fairly frequent 
phenomenon. Atmospheric disturbances disrupting high frequency 
communications occurred virtually every day in the Pacific. 

Even underwater cables to Japan had recently been cut 
accidentally by trawlers. During an actual crisis, all 
communications between NORAD and our Ballistic Missile Early 
Warning System (BMEWS) had gone out at the same time, because, as 
I recalled, a forest fire destroyed one set of landlines on one 
side of the continent and an earlier earthquake had destroyed the 
lines on the other. 

Nevertheless, commanders and staff officers had told me that 
they would regard a sudden disruption of communications during a 
crisis as a very ominous sign, requiring at the least a high level 
of alert and perhaps a launch of some planes. So the major wasn't 
answering differently from other bases. He just wasn't 
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acknowledging that his different directives would slow him down. 

Now the big question, what would the effect of these alerting 
measures be? I asked him what he thought would happen if he 
ordered the planes off. 

He said, "Well, you know what the orders are." He looked at 
me, but this time I said, "You tell me." 

"They go to a rendezvous area and fly around, waiting for 
further orders. They can do that for about an hour, and still have 
enough fuel to get to their targets or to come back. If they don't 
get an execute message, they're supposed to come back. Those are 
their orders." 

They would be out of communications with the base at their 
rendezvous area, he'd told me earlier. If they were there as part 
of a theater-wide alert, there would be a coordinating plane with 
them at the rendezvous with stronger communications gear, sent from 
another base. But if he had sent them up himself, they would be 
circling up there by themselves, unable to send any messages out. 

I asked, "How do you think that would work? If they didn't 
get an execute message." 


The major said, "Oh, I think they'd come back." Short pause. 
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"Most of them." 

The last three words didn't register with me right away 
because even before they were out of his mouth my head was 
exploding. I kept my face blank but I was screaming to myself 
inside, "Think? You think they'd come back?!" 

This was their commander, I was thinking, the one who gave 
them their orders, the man in charge of their training and 
discipline. 

He added, "Of course, if one of them were to break out of 
that circle and go for his target, I think the rest would follow. 
And they might as well. If one goes, they might as well all go. I 
tell them not to do it, though." ... 

I continued to keep a blank face. I had a few more questions 
to ask. Wasn't it true that there was a chance that these Mark-28 
weapons underneath the planes had some risk of a partial nuclear 
explosion if they were in an accident on the runway? He nodded. 

I set the scene. What .if the first five pilots to take off were to 
look back and see a mushroom cloud over the base, after the sixth 
plane exploded on the runway? What would they think, what would 
they do, after they felt the blast wave? 


His first response was indirect. 


"Well, of course it's not 
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like Okinawa, where that would mean to the pilots that their 
families had just been destroyed." He meant, it turned out, that 
the likelihood that pilots would disobey their instructions and go 
on to target without explicit orders would turn on who had been 
killed in that explosion, as much as whether they thought it was an 
accident or an attack. 

On Okinawa, where some of them had dependents stationed on the 
base, "they'd go on, of course," if a blast wiped out their 
families. After all, they couldn't be sure it was an accident. 

On Kunsan, if the pilots in the air realized that they'd lost the 
major and the base but they weren't sure it was an enemy attack, 
they might look for a recovery base and come back, if they didn't 
get a go-ahead order. 

After he had made this distinction, I reminded him that the 
premise of the question was that pilots had been launched on alert 
for the first time ever, whether by Tokyo/Osan or by the major. 
With that in mind, and all the more if this had arisen out of a 
crisis, he agreed that a nuclear explosion on Kunsan, or for that 
matter a report of one on Osan or Kadena, would make his pilots 
certain that an attack was underway. Communications would be out, 
so they couldn't get an order to return. They would go on to their 
targets. 

At one point in our discussion, the major mentioned a letter 
that Admiral Felt was holding from President Eisenhower authorizing 








34 


him to use his own judgment on using nuclear weapons if he were out 
of touch with Washington. I asked him where he'd heard about that, 
and he said he had heard it at Osan. So that story, whether it was 
true or not, wasn't confined to the Nuclear Control Officers at 
CINCPAC and at Seventh Fleet, who had told it to me. The major 
didn't claim that he or his immediate superiors had any such letter 
or verbal authorization like that, and he didn't make any 
connection between what he'd heard and the answers he was giving me 
about the initiatives he or his pilots might take. But it seemed 
to me there was a link, all right. There had to be. 
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END NOTES 

1. Note on development of narrative: 

Describe devices for making it physically impossible (rather 
than allegedly "unthinkable," "against orders") to launch or fire 
weapons without high-level or presidential authorization! what 
later came to be known as Permissive Action Links. 

I came onto this concept early, via Jack Carne, in 
investigating the authentication problem. . Describe this problem. 
Jack suggested the analogy of a combination lock (instead of an 
envelope, which is what I was criticizing) r He then suggested that 
the lock could be used to lock up the weapon from use, unless the 
proper code were supplied. 

(Find and quote my memo to AJW of 1958 on this issue. How did 
I learn about it that summer? Didn't I need to encounter it in the 
Pacific, in 1959? Yet I'm sure I wrote the memo in 1958). 

this threw into relief the "administrative" nature of the 
existing system of control, and the possibility of a different sort 
of system. The resistance to the latter, a physical system, 
exposed the true concerns of the military staffers and commanders. 

--some of these reflected operational realities, of which 
civilians tended to be unaware, and of which the military were not 
eager to educate them. (Complexity, planning time, training, 
unreliability of communications, vulnerability of command and 
control). 


-others reflected distrust of the will and nerve of civilian 
leaders, their resolution and steadiness, their desire for 
centralized control, their ignorance of the above factors and 
unrealistic belief in their ability to manage events; but also 
distrust of their willingness to use nuclear weapons, to go first 
to believe in or gamble on damage-limiting and preemption, to 
understand the possibilities of this and its dependence on fast 
reaction or preemption, the advantages of striking first* the 

possibilities of photo-reconnaissance and comint and elint 
(secret); 




all this pointed to extreme unwillingness (in 1961 and ever a 

since, when the issue arose: see Crimson Tide l to see physical 
control over the decision to launch. y 


See the sloppiness over authentication (the envelopes 

6arly as 1958: how? ) as a basic unconcern 
authentication, with who the order originated with. 


which 

with 


—Prior issue of vulnerability, 
with a preoccupation with first 
limiting). (But in my own education 


discovered by RAND; combined 
strike (and later, damage- 
, I discovered this late, not 
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till...1960? 1961? Then, the first-use part, not till...the 
Quemoy study of 1964? It came up on Berlin...see my concern for 
Khrushchev's threats in 1959, in my Lowell Lectures... 

A major reason for fearing physical control: fear that the 
president would take command of this himself, not only jeopardizing ^ 
survivability (if the president were killed) but, more importantly, 
slowing preemption if he were alive, foregoing preemption 
altogether, and preventing first-use. Note their efforts to get 
predelegation for Laos (vs. the Chinese); or Taiwan Straits?;'then 
the drive for it in the election campaign of 1964. \ 

The President couldn't have insisted on keeping the 
combination strictly for himself, given the survival problem; but 
he could have insisted that it be kept in the hands of civilian 

authority , along with drastic measures to assure that some civilian 

authority survived. The devolution problem: Partridge Committee, 

1961, and earlier the Gates Panel, both of which I worked on. 

Moreover, such an attitude would have gone along with 
forbidding them from delegating (or distributing combinations to 
PALS) to lower levels of command, for early first-use. (Note that 
PALS were long kept off SAC altogether, and are still off SLBMs. 
despite note at end of Crimson Tide . 

See issue of resist ance t o^PALS as: 1) a danger in itself; 2) 
symptomatic of an attitude, toward FU, preemption, damage-limiting, 
early initiation of all these, related to issues of force size and 
precision (see Discriminate Deterrence); 3) influence of these ^ 
attitudes on proliferation and imitation of hair-trigger postures 
in other countries; 4) aside from imitation, the likelihood of 
comparable attitudes and postures in all other nuclear countries. 

The recent form of these dangers and debates is in the context 
of automated launch-on-warning of missiles; the Russian "Dead Hand" 
or Doomsday system (unlocking and sending off missiles 

automatically) (close to Kahn's Doomsday Machine); and proposals 
for de-alerting. (All these problems arise primarily with alert 
weapons, though an unauthorized action could utilise an unalert 
weapon, where the incentive was something other than preemption 
e.g. terrorism or catalytic action. ' 


2 . Note some actual false alarms. World War I got underway f 
because Russia was hardwired to mobilize fully (i.e., against 
Germany as well as Austria) in response to German or even Austrian 
mobilization, even though the latter was aimed only at Serbia, not 
Russia; in turn, France was hardwired to mobilize if Germany (and 
its ally, Russia) did; and Germany was hardwired to attack France 
1 f^ u ? sla an< ^ France mobilized, in order to defeat France quickly 
and first before turning to attack Russia. 
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This was an exact counterpart to the nature and rigidity of 
SAC planning against the "Sino-Soviet Bloc." Note that I had 
studied the World War I case in the '50's, in particular by rea ding 
Sidney B. Fay's account of the origins of the war, and my thinking 
was very influenced by the parallel. « 

This was even before Barbara Tuchman's Guns of August 
introduced this analogy to JFK and others, with no discernible 
effect on nuclear war planning (despite JFK's directive that the 
book be read in all the war colleges). Tuchman's book might 
conceivably have influenced JFK toward caution during the Cuban 
Missile Crisis (though I know of no direct testimony regarding 
this). 

Scholarship in the last fifteen years, especially appearing in 
International Security , has strongly confirmed and elaborated these 



aspects of World War I planning and alerts on which my perception // 
of the analogy was based. I'm not sure that these historians have ^ 
ever become aware of how closely nuclear war preparations 
corresponded to these features. -- —-- 


But the work of Scott Sagan and Bruce Blair and John ^ . 
Steinbruner on command and control and alerting systems and dangers 
both in the US and the Soviet Union/Russia shows the same awareness 
and concern as mine. 

On false alarms: the Tower-Hart study for the Senate in 1978 
(?) showed some 174 (?) false alarms of strategic attack in an 18- ^ 

month period, including 3 serious ones. 

Other examples of major Soviet false alarms have come out in 
recent years. 

McNamara and Bundy continue to claim that Khrushchev's fear of 
a US invasion of Cuba in 1962, and his response to this fear, was 
a false alarm (though, they admit, one with some plausibility) is 
basically false. He was responding to real preparations and 
readiness, even if invasion was not a certainty. 

However, the "second Tonkin Gulf attack" on the DeSoto patrols \j 
in 19 64 was a strong example of a false alarm, leading to actual ' 
attacks in "response." 
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reprimanding them afterwards). 

The Manhattan Project, as a "response" to warnings of a German 
crash program on an atomic bomb. 

The US bomber buildup, as a response to the "bomber gap." 

The US bomber and missile buildup, as a response to the 
"missile gap." 

The Korean War, so far as the North Korean attack was seen as 
the precursor to attacks in Europe. 

The shootdown of an Airbus by the guided missile cruiser (?) 
Vincennes, in the Persian Gulf (in the belief that it was a 
military plane descending in an attack, whereas it was actually 
ascending). 

The shootdown of KAL-007 by a Soviet air defense pilot. 

Various false alarms (or potential false alarms, including a 
missile launch) on both sides during the Cuban Missile Crisis, 
described by Sagan. 

Other examples by Sagan. 

3. I'm not sure to what extent this claim was historically or 
bureaucratically deserved, but it was generally accepted at RAND. 
At the very least, he gave a useful explanation of its rationale, 
one that stimulated my own thinking very much. I can give an 
account of this rationale, if necessary, in the text, to give 
something of the nature and quality of RAND thinking of the sort 
that attracted me and that I participated in, and to give more body 
to the discussion that follows. Or not. 

4. This option has never existed for ballistic missiles, which 
cannot be recalled once launched. Reagan once made a public 
statement to the contrary, for submarine-launched missiles. He 
really may not have known better. Incredibly, Carter once made a 
similar statement. This is a dismaying confusion for a president 
to suffer. 

Something similar to positive control could be achieved for 
ballistic missiles if a "destruct in flight" capability were added 
to the missile, which could be triggered on command. This does 
exist for space shots, and perhaps for some tests, but not for 
military missiles with live warheads. 

(It could even be programmed to work automatically unless a 
positive signal were sent and received countermanding it! No one 
has ever suggested this, and it would be dangerous if it encouraqed 
national leaders to believe that they could launch missiles 
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relatively safely under ambiguous circumstances, given the 
likelihood that some of the destruct mechanisms would fail to 
operate. I mention it only because it would be an even closer 
counterpart to the positive control system for bombers, though of 
course it would not provide for the missile's return with its 
warhead, a procedure whose dangers would be hard to overlook.) 

This has often been proposed seriously, not really to permit 
launch on ambiguous warning but to permit destruCtion~in case of 
accidental or unauthorized launch. It has always been successfully 
resisted by the military, on the grounds that it would be one more 
complexity that could lead to misfire. But since under current 
circumstances the danger that a given missile will not explode when 
desired is much less important than the danger of accidental or 
unauthorized launch, the case for implementing this safeguard seems 
very strong. 

5. And his superiors might agree that he should not be punished, 
or even that he should be commended, for saving the ship even if he 
had been insubordinate. On the other hand, they .might feel that 
his disobedient initiative had to be punished even if it did save 
the ship. These uncertain prospects bear on the subordinate's 
expectation of punishment if he disobeys current orders. But for 
the most conscientious and experienced subordinates, that will not 
be the only or the determining consideration. 

It does not take a very acute reader to notice that my early 
interest in these questions prefigured the question as I saw it ten 
years later, whether I should copy the Pentagon Papers, violating 
instructions and my earlier promises. 

Dramatic accounts of mutinies present similar issues and 
subjective considerations. See The Caine Mutiny . Paths of Glorv . 
and in particular the Denzel Washington/Gene Hackman conflict in 
the submarine movie Crimson Tide , which deals with the precise 
ambiguities and decision problems considered here: whether or not 
to follow standing instructions on authentication; whether or not 
to launch submarine missiles on incompletely authenticated and 
transmitted orders; whether or not to accept the judgment of a 
particular local commander. Of course, the same issues were raised 
earlier in Dr. Stranqelpve . based on the books Red Alert and Fail- 
Safe. 


Jeff Stein's book on the deliberate, "well-intentioned” 
insubordination (deception of higher authority) underlying the 1969 
Special Forces murder trial, A Murder in Wartime , is discussed 
later, since the dropping of that case directly triggered my 
decision to copy the Papers. *“*-_ 


6. The recent book One-Point Safe , the more or less realistic 
journalistic account on which the movie is based, describes the 
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current safety standard as "one-point safe," i.e. as requiring only 
that there will be no significant yield unless more than one 
section is accidentally detonated. Frank von Hippel tells me that 
this is correct, in terms of current standards for safe weapons. 
This would seem to be a lower standard than we were told about in 
1960, but current designs might make it adequate. I am certain, 
from my notes, that the expression given to us and described then 
was "three-point safe," with anything less than that being regarded 
as significantly prone to nuclear accidents. 

7. There wasn't an easy fix. They could make full-scale 
rehearsals, taking off from alert pads with bombs aboard, routine, 
so that an intense false alarm wouldn't create a near-certain 
conviction that war was underway. 

This was what SAC did. And not without risk. Several 
accidents with planes on airborne alert causing the dropping or 
jettisoning of nuclear bombs led to high explosive detonations and 
in some cases the failure of safety mechanisms came close to 
permitting a nuclear yield. But the risks of this practice would 
have been much greater in the tactical forces. SAC weapons were 
much safer, and they were carried internally. 

In the Pacific and elsewhere in the tactical forces, the 
future, hypothetical danger I was projecting of the dangers of a 
possible false alarm would have been lowered by drills, but these 
would have raised the immediate, recurrent danger of an accidental 
explosion at the base (or from an airborne collision or 
malfunction) . That was not an appealing solution. 

Tactical forces with these weapons could have been taken off 
alert, throughout the world. (That, unquestionably, is what should 
have been done, for a whole variety of reasons including this one) . 
But that ran against a set of organizational barriers involving 
interservice and intraservice rivalries for budget and mission, 
units' sense of importance and elan, and the overall sense of 
crisis and threat that 'served and was fueled by these other 
incentives. 

Or some variant of Jack Carne's combination locks, what came 
to be called Permissive Action Links (PALS), could physically 
prevent the pilots of these planes from detonating their weapons 
without a positive order. (PALS were, eventually, installed on 
planes like these). 











